Data Studio Asset Sharing Compliance Gate

id: datastudio-asset-sharing-compliance-gate
namespace: company.team
description: |
  List who has access to a Data Studio report on a schedule by calling
  the Google Drive permissions API directly (Data Studio reports are
  Drive-backed files), classify the result as AT_RISK, HEALTHY, or
  UNREACHABLE based on whether any permission grants access to
  "anyone with the link", log clean audits, and alert Slack the
  moment link sharing is detected or the API cannot be reached.

inputs:
  - id: asset_id
    type: STRING
    defaults: "your-data-studio-asset-id"
    displayName: "Data Studio Asset ID"
    description: "The Data Studio report's asset ID, which is also its underlying
      Google Drive file ID."
  - id: flag_link_sharing
    type: SELECT
    defaults: "true"
    values:
      - "true"
      - "false"
    displayName: "Flag Link Sharing"
    description: "When true, any Drive permission with type anyone (anyone with the
      link) is classified AT_RISK."

triggers:
  - id: datastudio_sharing_gate_schedule
    type: io.kestra.plugin.core.trigger.Schedule
    description: "Audit asset sharing permissions every 6 hours."
    cron: "0 */6 * * *"
    disabled: true
    inputs:
      asset_id: "your-data-studio-asset-id"
      flag_link_sharing: "true"

tasks:
  - id: list_asset_permissions
    type: io.kestra.plugin.core.http.Request
    description: "List every permission on the report via the Google Drive v3
      permissions.list REST API. There is no dedicated Kestra plugin for the
      Data Studio API; Data Studio reports are Drive-backed files, so their
      sharing is read through Drive's own permissions endpoint."
    uri: "https://www.googleapis.com/drive/v3/files/{{ inputs.asset_id
      }}/permissions?fields=permissions(id,type,role,emailAddress,domain,displa\
      yName)"
    method: GET
    headers:
      Authorization: "Bearer {{ secret('GOOGLE_DRIVE_ACCESS_TOKEN') }}"
    allowFailure: true

  - id: classify_sharing_risk
    type: io.kestra.plugin.core.debug.Return
    description: "Classify UNREACHABLE when no response body was returned, AT_RISK
      when flag_link_sharing is true and at least one Drive permission has type
      anyone, otherwise HEALTHY."
    format: "{{ outputs.list_asset_permissions.body is defined ?
      ((inputs.flag_link_sharing == 'true' and
      (outputs.list_asset_permissions.body | jq('[.permissions[] | select(.type
      == \"anyone\")] | length') | first | default(0)) > 0) ? 'AT_RISK' :
      'HEALTHY') : 'UNREACHABLE' }}"

  - id: route_by_sharing_risk
    type: io.kestra.plugin.core.flow.Switch
    description: "Log a quiet confirmation when sharing is scoped to named users or
      domains, page Slack when the asset is shared with anyone holding the link,
      or page Slack when the API could not be reached."
    value: "{{ outputs.classify_sharing_risk.value }}"
    cases:
      "HEALTHY":
        - id: log_healthy
          type: io.kestra.plugin.core.log.Log
          message: "Asset {{ inputs.asset_id }} has {{ outputs.list_asset_permissions.body
            | jq('.permissions | length') | first }} permission(s), none granted
            to anyone with the link."
      "AT_RISK":
        - id: alert_at_risk
          type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
          url: "{{ secret('SLACK_WEBHOOK_URL') }}"
          payload: |
            {
              "text": "Data Studio sentinel AT_RISK: asset {{ inputs.asset_id }} has at least one Drive permission with type anyone out of {{ outputs.list_asset_permissions.body | jq('.permissions | length') | first }} total permission(s) (anyone with the link can access it). Execution {{ execution.id }}."
            }
      "UNREACHABLE":
        - id: alert_unreachable
          type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
          url: "{{ secret('SLACK_WEBHOOK_URL') }}"
          payload: |
            {
              "text": "Data Studio sentinel UNREACHABLE: no permissions were returned for asset {{ inputs.asset_id }} (invalid or expired access token, missing drive.readonly scope, or the file does not exist). Execution {{ execution.id }}."
            }
    defaults:
      - id: log_unclassified
        type: io.kestra.plugin.core.log.Log
        message: "Completed Data Studio sharing audit with status: {{
          outputs.classify_sharing_risk.value }}"

  - id: log_audit_status
    type: io.kestra.plugin.core.log.Log
    description: "Post-audit status line recorded on every run regardless of branch,
      for a continuous sharing-compliance trend in the execution history."
    message: "Data Studio sharing audit: asset={{ inputs.asset_id }},
      flag_link_sharing={{ inputs.flag_link_sharing }}, status={{
      outputs.classify_sharing_risk.value }}, execution={{ execution.id }}."

errors:
  - id: alert_flow_failure
    type: io.kestra.plugin.slack.notifications.SlackIncomingWebhook
    description: "Alert Slack when the compliance gate flow itself fails, so a
      broken audit never silently stops monitoring asset sharing."
    url: "{{ secret('SLACK_WEBHOOK_URL') }}"
    payload: |
      {
        "text": "Data Studio sharing compliance gate flow {{ flow.id }} FAILED (execution {{ execution.id }}). Sharing status for asset {{ inputs.asset_id }} is now unknown; check the task logs and the Drive API manually."
      }

outputs:
  - id: status
    type: STRING
    value: "{{ outputs.classify_sharing_risk.value }}"